1
00:00:00,000 --> 00:00:03,760
All righty. I hate reading bios, so I'm not going to.

2
00:00:05,160 --> 00:00:10,420
This is Alex. He's a good friend of the village for a couple of years now because he makes cool toys.

3
00:00:10,920 --> 00:00:17,640
Those of you that have been in the village for more than a few seconds have probably noticed one of his cool toys in the back where he's been posted up.

4
00:00:17,980 --> 00:00:22,940
And he's going to talk about what that device is and why it's cool.

5
00:00:22,940 --> 00:00:30,620
So, this is Alex with large-scale wireless monitoring using Kismet packet sniffer on a multi-radio array.

6
00:00:30,960 --> 00:00:34,240
And if you don't want one of these, you're probably in the wrong place.

7
00:00:34,480 --> 00:00:36,400
So, thank you, Alex. Please.

8
00:00:37,240 --> 00:00:38,080
Okay. Hi.

9
00:00:39,760 --> 00:00:40,280
Hi.

10
00:00:43,800 --> 00:00:44,980
So, hello, everyone.

11
00:00:45,160 --> 00:00:52,920
First of all, I wanted to thank this cool bunch of village people for, like, giving me this opportunity to speak.

12
00:00:52,940 --> 00:00:54,940
It's my first time at DEF CON.

13
00:00:55,160 --> 00:00:56,060
I mean, presenting.

14
00:00:56,320 --> 00:01:00,880
So, be gentle with me and, you know, you'll see how it goes.

15
00:01:02,960 --> 00:01:05,720
This is my presentation flow.

16
00:01:05,900 --> 00:01:06,720
Nothing really important.

17
00:01:08,840 --> 00:01:10,440
A few words about me.

18
00:01:10,740 --> 00:01:13,900
So, I spent about, like, 25 years in the high-tech industry.

19
00:01:14,360 --> 00:01:22,720
Turned to the security field about, like, six years ago to find out that actually all 25 years I did security as a matter.

20
00:01:24,020 --> 00:01:24,660
Sorry?

21
00:01:27,000 --> 00:01:27,880
Let me.

22
00:01:40,380 --> 00:01:41,500
Is it better now?

23
00:01:42,540 --> 00:01:42,880
Okay.

24
00:01:43,840 --> 00:01:51,020
So, I spent about 25 years in the high-tech industry, like, big names like Cisco, Alcatel, Ericsson, whatever.

25
00:01:51,280 --> 00:01:51,880
Okay.

26
00:01:52,940 --> 00:02:02,440
So, 25 years ago, I moved to security domain and found out that whatever I did for 25 years was actually a security field, right?

27
00:02:04,040 --> 00:02:08,620
Don't pay attention to all this alphabet soup, you know, underneath.

28
00:02:08,920 --> 00:02:16,980
I have to maintain my security profile to, you know, to work for a living.

29
00:02:19,480 --> 00:02:21,820
I do own a small company.

30
00:02:21,820 --> 00:02:22,920
I do own a small company.

31
00:02:22,940 --> 00:02:25,380
I do own a consulting company in Ottawa, Canada.

32
00:02:25,860 --> 00:02:37,500
Our main revenue stream is professional services, mostly in the security assessment and authorization field,

33
00:02:39,120 --> 00:02:46,200
which gives us enough money to reinvest into the all kind of cool R&D activities.

34
00:02:48,960 --> 00:02:52,320
So, our goal or our vision.

35
00:02:52,940 --> 00:02:59,980
For our R&D domain is create appliances to support open source software.

36
00:03:03,200 --> 00:03:06,240
I know, like, it's kind of like old stuff.

37
00:03:06,540 --> 00:03:08,220
You probably, most of you know about this.

38
00:03:08,320 --> 00:03:10,160
It's just like small recap.

39
00:03:11,500 --> 00:03:15,540
This is 2.4 gigahertz frequency band and Wi-Fi.

40
00:03:16,880 --> 00:03:19,520
We do have total of the 14 channels.

41
00:03:19,580 --> 00:03:22,740
Not all of them are visible for you, like, due to.

42
00:03:22,940 --> 00:03:30,180
You can see the regulatory domain, which is maintained by the firmware and the, uh, high level applications.

43
00:03:31,620 --> 00:03:37,640
When it comes to the 5 gigahertz domains, things are becoming a little bit more complex, right?

44
00:03:37,780 --> 00:03:47,560
It's more channels, uh, it's provisioning for like, wider WIS channel, like, 40, 80 and up to 160 mHz.

45
00:03:49,620 --> 00:03:49,920
Recently.

46
00:03:50,200 --> 00:03:52,920
So, you kinda get a picture how many channels there are.

47
00:03:52,920 --> 00:04:04,180
uh one should to cover uh when we do perform sniffing and monitoring. Um the basic concept

48
00:04:04,180 --> 00:04:10,880
of the wireless monitoring is like it's RF monitor mode which is uh which does allow a

49
00:04:10,880 --> 00:04:17,000
wireless network interface controller to monitor all traffic received from the wireless

50
00:04:17,000 --> 00:04:24,540
network. Now uh the difference is between like you know which is most which is less

51
00:04:24,540 --> 00:04:31,720
relevant in the wireless domain is that RF one allows packets to be captured without uh your

52
00:04:31,720 --> 00:04:39,860
network controller to be associated with any access point or like uh ad hoc network entity. Um

53
00:04:41,620 --> 00:04:46,980
so RF one is the uh it's a feature that allows you to uh to monitor all traffic received from the

54
00:04:47,000 --> 00:04:54,100
that is implemented in the hardware. So when we talk about hardware we and support of RF one

55
00:04:54,100 --> 00:05:02,660
model or not is kinda like by fold is end its end hardware capability as well as the driver

56
00:05:02,660 --> 00:05:15,040
capability to to turn it on. So uh very select subsets of chipsets do support uh RF one. If you go to

57
00:05:17,000 --> 00:05:23,320
guys like Aircrack NG or Kismet Wireless you'll see the list of the supported cards or

58
00:05:23,320 --> 00:05:30,160
supported wireless appliances in a USB or PCI Express domain and you'll see which ones are

59
00:05:30,160 --> 00:05:35,020
supported right. Sometimes they do refer to the card itself, sometimes they do refer to the

60
00:05:35,020 --> 00:05:46,980
chipset that this card employs. A small word about the antenna arrangement. So the

61
00:05:47,000 --> 00:05:54,580
as you can understand antenna is very important thing when we monitor. Like think about it

62
00:05:54,580 --> 00:06:01,260
like you have like hi-fi audio system, the top some notion you do connect it to the you know

63
00:06:01,260 --> 00:06:09,060
lousy loudspeakers. Result is obvious right. So good antenna good good antenna arrangement is

64
00:06:09,060 --> 00:06:16,980
critical for the successful monitoring. Um the antenna arrangement is critical for the

65
00:06:17,000 --> 00:06:25,960
the quality or like characteristics of antennas are basically you can um describe in the

66
00:06:25,960 --> 00:06:34,380
three domains like power gain, directive for gain and polarization. So power gain is basically

67
00:06:34,380 --> 00:06:44,480
it's a ratio um it's a ratio between power produced uh by uh antenna from the remote power

68
00:06:44,480 --> 00:06:46,980
source uh and the power gain. So the power gain is basically it's a ratio between the power

69
00:06:46,980 --> 00:06:48,660
gain of theyang to the length of the antenna and the power gain of the antenna. Now in the

70
00:06:48,660 --> 00:06:54,880
uh and hypothetically loose antenna right, which is measured by uh DBI which stands for the

71
00:06:54,880 --> 00:07:05,660
that's the bell's isotropic and uh decibel is logarithmic unit when you do compare to uh to values DBA

72
00:07:16,980 --> 00:07:19,960
which basically refers to the ability of the antenna

73
00:07:19,960 --> 00:07:24,880
to receive signal from one direction

74
00:07:25,140 --> 00:07:28,200
and basically gently reject signals

75
00:07:28,200 --> 00:07:31,540
that are coming from those other directions.

76
00:07:31,820 --> 00:07:33,260
We'll come to this later on.

77
00:07:33,940 --> 00:07:39,740
Polarization is a way that antenna emits signal

78
00:07:39,940 --> 00:07:45,820
into the air, so we do recognize two kinds of polarization,

79
00:07:45,820 --> 00:07:47,220
polarization, vertical and horizontal,

80
00:07:47,820 --> 00:07:52,440
and basically, rule of thumb, polarization is,

81
00:07:53,520 --> 00:07:59,040
it's the same plane as main antenna elements are at.

82
00:07:59,440 --> 00:08:02,880
For example, if you do take vertical antenna, right,

83
00:08:03,000 --> 00:08:04,660
so it's vertical polarization.

84
00:08:05,720 --> 00:08:07,820
Horizontal, horizontal, it's very simple, right?

85
00:08:09,360 --> 00:08:15,700
You know, I did deal with the very knowledgeable RF

86
00:08:15,820 --> 00:08:19,840
antenna engineer who could explain me all this stuff

87
00:08:19,840 --> 00:08:24,080
using fingers on one hand, it's kind of really simple,

88
00:08:24,200 --> 00:08:27,140
without diving into the glory details.

89
00:08:29,920 --> 00:08:33,320
Shortly, overview of antennas that people use

90
00:08:33,320 --> 00:08:37,420
for the monitoring, so everybody knows, like,

91
00:08:37,500 --> 00:08:38,960
rubber duck or deep hole antenna.

92
00:08:40,100 --> 00:08:44,480
Yagi antenna, it's more kind of narrow band antenna.

93
00:08:45,820 --> 00:08:48,400
Log periodic, Vivaldi, patch and panel.

94
00:08:48,620 --> 00:08:53,020
So what's cool about these two antennas in particular,

95
00:08:53,660 --> 00:09:00,620
log periodic and Vivaldi, is extremely wide frequency range coverage.

96
00:09:01,340 --> 00:09:10,200
Another quality, I died, one, two, three.

97
00:09:34,280 --> 00:09:42,780
What's great about these ones, it's a lot of blinkers,

98
00:09:42,780 --> 00:09:43,060
I personally like their, I quite like their range,

99
00:09:43,060 --> 00:09:43,180
It's a little bit of distance.

100
00:09:43,180 --> 00:09:43,620
If you have, you know, a table-to-table wall,

101
00:09:43,620 --> 00:09:44,320
it's the same, you have to go into each room,

102
00:09:44,320 --> 00:09:44,420
and there's a little bit of distance.

103
00:09:44,420 --> 00:09:44,600
So you have 6,000, 6,000, 6,000.

104
00:09:44,600 --> 00:09:45,140
So you really set up.

105
00:09:46,820 --> 00:09:55,460
keep them together. So what's really cool about this log periodic and Vivaldi antennas is

106
00:09:55,460 --> 00:10:01,380
that they can be implemented using simple printed circuit board, right? So it's very easy

107
00:10:01,380 --> 00:10:15,120
to manufacture. If you go Google you'll find multiple designs and multiple applications. What

108
00:10:15,120 --> 00:10:25,760
frequency range coverage. That's kind of small overview like what each antenna uh stands for.

109
00:10:26,300 --> 00:10:34,540
Um so rubber duck as you see like all these guys are using is uh is omnidirectional and

110
00:10:34,540 --> 00:10:43,980
propagating radio frequency energy like 360 degrees in a in a horizontal plane and basically

111
00:10:45,120 --> 00:10:52,200
you can find like do it yourself kits uh on the on the web if you take like piece of wire make it

112
00:10:52,200 --> 00:10:58,780
like half or quarter wavelength so the desirable band may you see it's probably the best thing

113
00:10:58,780 --> 00:11:05,860
that you can get. Uh a log periodic antenna it's multi element directional. So it's approximately

114
00:11:05,860 --> 00:11:14,880
30 degrees horizontal and 30 degrees vertical. But uh in terms of gain so rubber ducks

115
00:11:15,120 --> 00:11:24,540
you'll find somewhere between like 3 dBi up till 7 dBi for like 2.4 and 5.8 and 5.8 gigahertz

116
00:11:24,540 --> 00:11:35,800
bands. A log periodic uh you'll you may gain in a small form factor up till 16. Right? So it's

117
00:11:35,800 --> 00:11:44,440
even though being directional somewhat gain is incomparable. Another thing is that with the

118
00:11:45,120 --> 00:11:49,860
rubber duck antennas when you do buy dual band rubber duck antennas you you have to remember

119
00:11:49,860 --> 00:11:56,500
that it's always a compromise. Right? So it's kinda performance okay-ish on a 2.4 and okay-ish

120
00:11:56,500 --> 00:12:04,480
on the 5.8 but not on the both of them. Right? So if a if you compare quality and gain of

121
00:12:04,480 --> 00:12:15,020
rubber duck antennas that are uh uh mono band it's much higher gain. Right? Um and so on.

122
00:12:15,120 --> 00:12:20,680
Vivaldi, patch, Yagi antenna, panel antenna. So all of them do have certain you know area of

123
00:12:20,680 --> 00:12:29,160
application. Um we started to play internally with the Vivaldi and log periodic antennas and

124
00:12:29,160 --> 00:12:37,900
we do gain extremely good results. Right? Um this is kinda for fun. You know what I when I did

125
00:12:37,900 --> 00:12:45,000
uh you know studies this all this horizontal vertical sync. Right? I found out this uh block

126
00:12:45,120 --> 00:12:52,640
by the senior uh Apple RF engineer. Which I can kind of found funny uh by the same token

127
00:12:53,150 --> 00:12:58,940
obvious. Right? And I tested this thing at home with my kids like MacBooks and believe it or

128
00:12:58,940 --> 00:13:05,720
not I hit it just like amazing results. Right? I see gain boom right on the spot. The whole

129
00:13:05,720 --> 00:13:10,700
thing is that in the in the you know MacBook where do you think antenna is? Right? It's kinda

130
00:13:10,700 --> 00:13:15,100
it's metal aluminum shell. Right? Where do they put antenna? Well the antenna is in the middle of the

131
00:13:15,100 --> 00:13:19,780
wall. They put the antenna in this small plastic area on the hinge. Right? So the only way they

132
00:13:19,780 --> 00:13:25,080
can do it like just they put it like you know horizontally. Right? So here you go. You have

133
00:13:25,080 --> 00:13:31,740
your horizontal polarization. Now if you will just move your outer antenna one of them you know

134
00:13:31,740 --> 00:13:42,400
horizontally you will see significant gain in crease. A significant um significant uh um

135
00:13:43,420 --> 00:13:45,080
power level increase. So you can see the uh the uh the uh the uh the uh the uh the uh the uh the uh

136
00:13:45,100 --> 00:13:45,660
difference you can see between the two. And this is what they can do with the USB port EMeniz

137
00:13:45,660 --> 00:13:47,320
but you can't see through. This is web monitor device kind of stupid but it works fine. You know

138
00:13:47,320 --> 00:13:55,060
like I just test to it home. It just works just fine. Er yeah. Sorry? Is that omni or

139
00:13:55,060 --> 00:14:03,180
getting directory. This, this is omni. Right? But again you know where's the uh main uh element

140
00:14:03,180 --> 00:14:08,920
is. Which plane here you know there. One of its,

141
00:14:15,100 --> 00:14:22,640
choices right? You can always start with the uh purposefully built appliances like wifi uh

142
00:14:22,640 --> 00:14:29,300
pineapple which you can buy here at the Wenders area. Uh many people use uh USB based

143
00:14:29,300 --> 00:14:35,540
dongles right? For for example these guys over there they heavily utilize USB based

144
00:14:35,540 --> 00:14:43,980
dongles as I noticed. Um the problem with USB uh dongles is that they're mostly made um in

145
00:14:43,980 --> 00:14:51,600
Asia. It's kind of like mass production thing right? And antenna wise unless it's external

146
00:14:51,600 --> 00:15:00,780
antenna it's internal built in PCB or ceramic chip antenna with very low quality right? So don't

147
00:15:00,780 --> 00:15:06,880
expect to you know to see a lot from this uh cheap USB adapters. Even though they might be

148
00:15:06,880 --> 00:15:13,960
compatible with the other phone no one says that it's wrong but uh drivers are an issue as

149
00:15:13,980 --> 00:15:21,340
well. Uh whatever sources that we have that are coming from overseas uh well they need

150
00:15:21,340 --> 00:15:30,720
heavily fixing. Uh they need heavy fixing and uh they're not as polished as the you know uh as

151
00:15:30,720 --> 00:15:39,220
for example PCI Express. Uh in a PCI Express you have much more offerings uh in terms of

152
00:15:39,220 --> 00:15:43,960
like quality products right? Um the the the the the the the the the the the the the the the the

153
00:15:43,980 --> 00:15:51,360
quality of your device. Uh we do have a readily available few kinds of PCI Express radio cards

154
00:15:51,690 --> 00:16:01,720
so the first two on the top is PCI PCI Express mini which is basically uh your your PCI your PCI

155
00:16:01,720 --> 00:16:10,780
Express single lane interface minus twelve volts power rail. To be like to simplify things right?

156
00:16:10,900 --> 00:16:13,960
Uh they do come as a full length and as a single line you can open the whole box and you can opening

157
00:16:13,960 --> 00:16:16,420
the half length. Depends on the chipset, depends on the

158
00:16:16,420 --> 00:16:23,140
manufacturer. Um when we talk about the powerful cards like for

159
00:16:23,140 --> 00:16:26,820
example the ones that are that are produced by company by name

160
00:16:26,820 --> 00:16:32,580
Microtech or like powerful A to A11 AC cards which are produced

161
00:16:32,580 --> 00:16:38,220
by for example company like Compex. They do they do equip

162
00:16:38,220 --> 00:16:41,580
them with the heat sinks because uh they do have heat

163
00:16:41,580 --> 00:16:49,460
dissipation uh issue so you have to drive heat off of uh of the

164
00:16:49,460 --> 00:16:55,660
card. Uh newly uh like relatively new standard is M2

165
00:16:56,740 --> 00:17:01,320
which uh which basically is going to replace uh wireless

166
00:17:01,320 --> 00:17:04,020
cards on each and every laptop that you will see coming

167
00:17:04,020 --> 00:17:08,200
forward. Uh form factor is almost twice smaller than the

168
00:17:08,220 --> 00:17:15,400
normal PCI Express Mini. Um uh the uh quality cards are from

169
00:17:15,400 --> 00:17:22,020
Intel. It's 80 to 60, 70 to 60. Uh but again if you do have PCI

170
00:17:22,020 --> 00:17:26,600
Express Mini slot in your system you'll have to go and buy of

171
00:17:26,600 --> 00:17:34,000
eBay or from Amazon adapters that uh will uh convert uh M2 uh

172
00:17:34,340 --> 00:17:36,460
pin out form factor to PCI Express Mini.

173
00:17:38,460 --> 00:17:46,100
Um now talking about PCI PCI Express Mini. Um uh historically

174
00:17:46,440 --> 00:17:53,240
the most friendly uh chipsets uh uh ever produced uh were from

175
00:17:53,240 --> 00:17:57,620
company by name Atiros. This is where I don't know if you've

176
00:17:57,620 --> 00:18:02,700
heard or not like driver family like ATH 9K, ATH 10K and so on

177
00:18:02,700 --> 00:18:08,200
so forth. So these are probably the best chipsets in in uh PCI

178
00:18:08,220 --> 00:18:14,520
160 industry. So majority of them if not all of them are Pc ah uh

179
00:18:14,520 --> 00:18:23,500
PcXS based. So if you wanted to go and excel in a monitoring so which

180
00:18:23,500 --> 00:18:26,840
have choice between weigh-in PCI Express I would say go to

181
00:18:38,140 --> 00:18:45,420
monitoring. You can always Google them and take a look what they do. Uh we tried recently

182
00:18:46,620 --> 00:18:57,800
uh where was that? We tried recently uh acrylic wifi. It's a small company in Spain and they

183
00:18:57,800 --> 00:19:05,800
make amazing piece of software uh that is capable of producing so called heat maps. Unfortunately

184
00:19:05,800 --> 00:19:17,700
it it's Windows based software so whoever hates Windows need to suck it up. Um our darling

185
00:19:17,700 --> 00:19:23,980
and our like and we talk about this going forward our darling and our favorite scanner is

186
00:19:23,980 --> 00:19:33,300
Kismet and I'll explain why in a few slides. Um now when we talk about wireless security

187
00:19:33,300 --> 00:19:40,380
monitoring or wireless monitoring challenges right? So there are few aspects. First of all

188
00:19:40,380 --> 00:19:49,720
we do have like legitimately two frequency bands. 2.4 and 5.8. Uh across these two bands

189
00:19:49,720 --> 00:19:56,460
we do have multiple channels arrangements right? For example uh appliance that we are going

190
00:19:56,460 --> 00:20:03,280
to present today uh cards are 802.11a BGN and across these two bands we do have multiple

191
00:20:03,300 --> 00:20:08,780
channels. So basically the aggregated channel capability is 84. So each card is capable of

192
00:20:08,780 --> 00:20:13,540
scanning 84 channels with different arrangements. Different frequencies, different channel

193
00:20:13,540 --> 00:20:20,760
V's and so on and so forth. Now if you do uh monitor if you aim monitor 84 channels so

194
00:20:20,760 --> 00:20:26,700
basically scanning goes like you tune to the channel, you sit there, you listen, whatever you

195
00:20:26,700 --> 00:20:33,140
can capture from the air. When you're happy you move on to the next channel. Like if you will

196
00:20:33,300 --> 00:20:39,580
hope like this 84 times you can understand that once when you will finish your loop and you'll go

197
00:20:39,580 --> 00:20:47,080
back to the channel number one some time will elapse right? So chances are that you or you'll

198
00:20:47,080 --> 00:20:57,420
miss something right? Uh or you will not capture whatever you need. Right? Um another uh

199
00:20:57,420 --> 00:21:03,280
challenge is discovery versus tracking right? So uh I'm not going to go into too much detail here.

200
00:21:03,300 --> 00:21:07,520
Cause under circumstances it depends on the task in hand. You might need not only to discover

201
00:21:08,200 --> 00:21:15,640
wireless appliances uh in a proximity you also want to track them down right? Means that okay

202
00:21:15,640 --> 00:21:20,500
how often they do appear, when you did see them first time, when you did see them last time, how

203
00:21:20,500 --> 00:21:27,540
you know active you are and uh they are and so on and so forth. So this all of this uh creates a

204
00:21:27,540 --> 00:21:33,280
uh challenge for fast and full monitoring. Uh this is a challenge uh for fast and full monitoring.

205
00:21:36,120 --> 00:21:41,300
um now when we talk about monitoring like if I'll say you that okay now we have single

206
00:21:42,420 --> 00:21:47,780
single radio card we have 84 channels to cover and we kind of hope from channel to channel

207
00:21:47,780 --> 00:21:52,920
sitting on each channel for a certain period of time waiting for frames to arrive once we

208
00:21:52,920 --> 00:21:59,140
are happy we move on what if you have like multiple cards what if what if we will have

209
00:21:59,140 --> 00:22:06,820
ability to to talk simultaneously to multiple uh capturing devices or multiple resources right

210
00:22:07,290 --> 00:22:13,180
so let's say you have two cards right you can always say okay now card number one will be

211
00:22:13,180 --> 00:22:21,720
tasked to capture from channel H to channel B and card number two from channel C to channel D in

212
00:22:21,720 --> 00:22:28,500
a sense what it gives you it gives you twice more presence on each given channel right and so

213
00:22:28,500 --> 00:22:28,960
on so forth.

214
00:22:29,140 --> 00:22:37,580
More cards you will employ you know more you will be present on each particular channel more

215
00:22:37,580 --> 00:22:48,500
you'll capture. Um you can distribute this workload to balance workload across multiple uh

216
00:22:48,500 --> 00:22:54,120
sources. Uh you can switch between channels faster right because you will come back to them

217
00:22:54,120 --> 00:22:59,120
faster right. Um and and uh another thing you can do is you can uh you can uh you can uh you can

218
00:22:59,140 --> 00:22:59,300
do is you can do a little bit of Russive tracking to make sure your collectors don't have to

219
00:22:59,300 --> 00:23:02,640
the part of the thing that's the most important thing is that with all this 20 MHz channel this 40

220
00:23:02,640 --> 00:23:12,720
80 in the AC 80 plus 80 and 160 mhz you are physically kinda in the same frequency sport right

221
00:23:12,720 --> 00:23:21,080
right? But you should tune your radio differently to capture data from different channels.

222
00:23:21,740 --> 00:23:30,620
Um and we talked about balance and uh versus tracking monitoring. So here's appliance that

223
00:23:30,620 --> 00:23:37,140
we created, right? So I uh idea behind was very simple, right? So we wanted to give to

224
00:23:37,140 --> 00:23:45,280
community something that uh that uh can utilize multiple high quality PCI express mini and M2

225
00:23:45,530 --> 00:23:54,040
radio cards to be easy to use, right? Uh we uh we did equip this appliance with standard uh

226
00:23:54,040 --> 00:24:05,740
X86 uh Intel platform. As you can see it's sort of standard mini ITX low profile

227
00:24:05,740 --> 00:24:12,280
motherboard. Such as developers will not spend time with ARM or MIPS or like whatever the CPUs

228
00:24:12,280 --> 00:24:17,120
they have with patches with you know kernel and so on and so forth. So this appliance actually

229
00:24:17,120 --> 00:24:27,040
runs whatever any PC will uh w- w- whatever any PC would, right? Um appliance has the

230
00:24:27,900 --> 00:24:35,720
provisioning for uh 9 PCI express mini slots. So you can choose your commodity or you can

231
00:24:35,740 --> 00:24:42,600
choose whatever compatible cards from from Amazon from Ebay from other sources,

232
00:24:42,760 --> 00:24:52,340
right? Inst- installs them and just uh have yourself multi radio uh multi radio array. Uh

233
00:24:52,340 --> 00:25:00,280
a choice for the antennas as the end connectors, so rather than SMA was the filter application

234
00:25:00,640 --> 00:25:05,720
because we uh our first prototype was based on uh SMA uh so on'multi- um uh it was uh we made uh

235
00:25:05,740 --> 00:25:10,980
SMA connectors and SMA antennas. Like after like 20, 25 times of like putting them on,

236
00:25:11,040 --> 00:25:20,520
taking them out, we found out that thread on the connector was gone. Right? So it's no

237
00:25:20,520 --> 00:25:28,240
point. And, and connectors are professional quality. You have much more professional

238
00:25:28,240 --> 00:25:35,720
antenna offerings from the market. Um, and we found it like, you know, um, you know,

239
00:25:35,740 --> 00:25:45,900
somewhat easier to use. Uh, again, so it's flexible because it allows you to install any

240
00:25:45,900 --> 00:25:54,480
op. So our PCI Express slots in this device are fully populated with the USB 2.0. So if you

241
00:25:54,480 --> 00:25:57,860
have like, you know, Bluetooth cards or something like that, or cards that are combo

242
00:25:57,860 --> 00:26:05,720
cards, uh, Wi-Fi plus Bluetooth, they will work fine as well. Um, and, and we found that, um,

243
00:26:05,740 --> 00:26:08,880
it actually works fine. And the, the, as they said uses any commercially available mini AC

244
00:26:08,880 --> 00:26:17,120
Express. You have your card, x86 platform composite with anything that is available, with any

245
00:26:17,120 --> 00:26:29,080
open source. Um, well it's kinda just just walk over through the main feature. This is how

246
00:26:29,080 --> 00:26:35,720
a device looks like inside. And you see is here a nice RF cable? So these arecular cables and

247
00:26:35,740 --> 00:26:42,520
signals, which do have very low signal loss. Um, as I said, it's, uh, our standard offering

248
00:26:42,520 --> 00:26:55,680
is, uh, uh, quad-core Brasswell Intel Celeron, uh, 8 gig of RAM, 64 gig of solid state. Uh,

249
00:26:56,560 --> 00:27:02,800
we can, uh, also, uh, populate it with up to two terabytes of the, of the retention

250
00:27:02,800 --> 00:27:09,940
storage, 9 PCI Express mini slots, which can accommodate any PCI Express or M2 card. Um,

251
00:27:18,640 --> 00:27:25,480
that's it, basically, what do we plan to do, what our plans to do next as the hardware goes,

252
00:27:25,620 --> 00:27:32,780
right? We just, uh, finalized the, uh, development of the, uh, 12 card, uh, uh, memory card,

253
00:27:32,800 --> 00:27:41,240
uh, carrier, which looks like this. It's the first prototype board. Uh, it looks like visually

254
00:27:41,240 --> 00:27:48,640
as the, uh, standard PCI Express mini carrier board, but it's actually fine-tuned, uh, for the,

255
00:27:48,780 --> 00:27:55,020
uh, wireless applications. And I'll explain in the, in the, in the second, on the next, uh,

256
00:27:55,020 --> 00:28:02,360
slide, what do I mean by this. Uh, we do plan to, uh, it, it's in works, uh, mini PCI Express,

257
00:28:02,800 --> 00:28:09,920
for a factor of what channel sub-gigahertz radio card, this coverage from 119 to 960

258
00:28:09,920 --> 00:28:16,660
mi, mi hertz frequency range. And when I mean, when I'm saying what channel I mean what radio.

259
00:28:17,020 --> 00:28:29,560
It's true quad radio card. Uh, we do plan to, um, to create a quad, uh, quad card mini PCI

260
00:28:29,560 --> 00:28:32,780
Express, mini, uh, Bluetooth, so, and, um, uh, as I call it, anyway, uh, uh, a, a, uh, uh, uh, uh,

261
00:28:32,800 --> 00:28:37,820
energy with uh which will be compatible with the uh new 5.0

262
00:28:37,820 --> 00:28:44,860
standard. Uh and we also plan to uh create our own form factor

263
00:28:44,860 --> 00:28:52,060
uh our own quad uh channel quad radio ABGN AC receiver. So all

264
00:28:52,060 --> 00:28:56,120
these cards will be in a purely receive mode. No need transmit

265
00:28:56,120 --> 00:29:03,480
no nothing but we'll do it as uh as we need. Uh also our plans

266
00:29:03,480 --> 00:29:12,480
are to create 360 directional antenna array uh to try out to um

267
00:29:13,210 --> 00:29:20,520
um track physical uh location of the wireless appliance in the

268
00:29:20,870 --> 00:29:26,100
proximity. Oh this is how this card will work. This is the

269
00:29:26,120 --> 00:29:31,160
look like. It has kind of two layers. So uh lower layer lower

270
00:29:31,720 --> 00:29:37,880
layer will will have four PCI express mini slots and uh uh

271
00:29:38,160 --> 00:29:42,000
another eight are going on the top. So when I said that it will

272
00:29:42,000 --> 00:29:47,320
be fine tuned for the uh wireless application is uh is

273
00:29:47,320 --> 00:29:55,640
the following. Um currently developing and soon to appear on

274
00:29:56,120 --> 00:30:01,200
the market. Uh eight to two eleven AC wave two radio cards do

275
00:30:01,200 --> 00:30:06,420
have excessive power budget requirements. So standard PCI

276
00:30:06,420 --> 00:30:11,280
express mini slot can supply only up to 13 watts of the power.

277
00:30:11,480 --> 00:30:19,240
So new uh tripplin uh quad chain AC cards uh do have special

278
00:30:19,240 --> 00:30:25,720
arrangement for five volts rail on addition to the standard 3.3 volt

279
00:30:26,120 --> 00:30:31,720
on the PCI express slot. The reason for that they do uh uh uh they

280
00:30:31,720 --> 00:30:38,080
need this voltage to uh power up the uh power amplifiers on the card.

281
00:30:38,280 --> 00:30:43,400
Right? So which in a sense it it's beyond 13 watts. So if you have

282
00:30:43,400 --> 00:30:47,100
chance to buy this card you'll not be able to use it in the standard PCI

283
00:30:47,100 --> 00:30:52,160
express mini slot. So what vendors do uh there are certain pins on the PCI

284
00:30:52,160 --> 00:30:56,100
express mini connectors that are unspecified by the standard. They're

285
00:30:56,120 --> 00:31:03,700
actually vendors are free to use them as they see them fit. So in a particular uh big

286
00:31:03,700 --> 00:31:13,240
vendor like Compex uh they just about to release uh quad chain AC cards where they

287
00:31:13,240 --> 00:31:20,680
have five volt power rail on these pins. So we do accommodate this uh feature as well.

288
00:31:20,820 --> 00:31:25,940
So another thing is that uh we do recognize this card as a maybe

289
00:31:26,120 --> 00:31:33,800
stand alone gadget. So we have uh arrangement for the remote PCI express uh connectivity.

290
00:31:34,840 --> 00:31:49,020
Um which will be done through the USB 3.0 cable. Now Kismet. So Kismet I mean I'm sure like

291
00:31:49,020 --> 00:31:56,100
many people used it in the in the in the past. I just will go through uh this tool uh uh this tool.

292
00:31:56,120 --> 00:32:02,580
very fast. It's network detector and packet sniffer for like 8 to 2 lead into wireless

293
00:32:03,120 --> 00:32:10,160
LANs even though like uh maintainer uh wants to add and Bluetooth and sub gigahertz radio

294
00:32:10,160 --> 00:32:20,600
uh functionality and so on so forth. Um it used by thousands of professionals as a baseline

295
00:32:20,600 --> 00:32:26,100
for intrusion uh detection systems. Uh maintainer of uh through to a very high frequency uh

296
00:32:26,100 --> 00:32:35,080
Kismet wireless claims having in excess of 50,000 downloads a month. So this is just to

297
00:32:35,260 --> 00:32:44,800
give you an idea how big the community is. Uh Kismet probably one of the very few passive

298
00:32:45,820 --> 00:32:52,220
scanners which means that it doesn't emit anything to the wireless environment. It doesn't

299
00:32:52,220 --> 00:33:00,100
produce any beacon request frames. It's not detectable because it doesn't send anything out.

300
00:33:00,580 --> 00:33:08,100
Um it uh has capability to detect both like access points, wireless clients and uh uh

301
00:33:08,640 --> 00:33:16,400
corresponding associations. Uh is it is the most widely used and up to date open source

302
00:33:16,400 --> 00:33:22,200
tool. Uh as we speak the changes are going to the git on a daily and on a daily basis. Uh

303
00:33:22,220 --> 00:33:36,860
the hourly basis. Um so it also has capability to uh uh to get in uh GPS data in NMEA format.

304
00:33:37,370 --> 00:33:47,560
Uh and has capability to create the uh wireless objects detected versus the geolocation versus

305
00:33:47,560 --> 00:33:49,840
geolocation of the sniffer itself.

306
00:33:52,320 --> 00:34:01,140
So this is demo that you will see over there near near the wall. So we do have our air bat

307
00:34:01,140 --> 00:34:08,120
appliance which runs Kismet server. We do have client which is basically simple web browser.

308
00:34:10,700 --> 00:34:19,280
It's kinda it's a screen shots from the latest uh git version of the Kismet. Probably not the

309
00:34:19,280 --> 00:34:21,200
same Kismet as you saw like.

310
00:34:22,220 --> 00:34:52,200
You know in the past now it's purely sort of like client server architecture where where the client or like visual GUI is it's your browser. Right? Um same functionality underneath tool was uh has a major improvement last uh four or five months uh with lots of optimizations. Um when I look at the

311
00:34:53,440 --> 00:34:59,980
the counter how many devices do we see on the Kismet right now it was I think it was fourteen

312
00:34:59,980 --> 00:35:22,200
thousand. This is how many devices we see around here right now. Um so if you will approach this desk I will show you all the screen kinda live. Um all the particular clients uh associated with the

313
00:35:22,200 --> 00:35:31,560
the access points. This one is interesting because it shows you all the resources capable in

314
00:35:31,560 --> 00:35:37,740
the color schema and then shows you dynamically how each resource hops from channel to

315
00:35:37,740 --> 00:35:48,320
channel without overlapping. It's a plugin that shows you how many devices it sees right

316
00:35:48,320 --> 00:35:57,560
now, how many packets a second Kismet takes in, how many channels are subject to scan, and

317
00:35:57,560 --> 00:36:14,620
how many active sources are employed. All of us do this stuff, you know, we are passionate

318
00:36:14,620 --> 00:36:18,200
about what we are doing. Like open source community, people are actually doing

319
00:36:18,200 --> 00:36:18,300
something. You know, we are passionate about what we are doing. Like open source community,

320
00:36:18,300 --> 00:36:23,520
people are actually doing something for a living, right? Whatever they do create, they

321
00:36:23,520 --> 00:36:30,320
do create in their free time, you know, like taking time from family, from kids, from et

322
00:36:30,320 --> 00:36:43,140
cetera. The maintainer and the author of Kismet is Dragan. He created this tool both in need

323
00:36:43,140 --> 00:36:48,280
and the passion. He could have charged for it, but he pushed a reward because he doesn't

324
00:36:48,280 --> 00:36:55,520
you choose not to, it takes a great amount of time and effort and skill to maintain Kismet

325
00:36:55,520 --> 00:37:02,100
and enhance its features. He never charged the community for this. So what we are saying

326
00:37:02,100 --> 00:37:14,220
is that we kind of strongly suggest the community to support the guy, right? I mean, any kind

327
00:37:14,220 --> 00:37:20,840
of donations towards his project will be helpful. Whatever it will be, like $1, $5, $10, $100,

328
00:37:21,510 --> 00:37:28,760
whatever. Corporate support is welcome as well. So me, like personally, I'm going to tweet

329
00:37:29,700 --> 00:37:40,260
smoking today, and I'll dedicate my smoke money to this guy right now. So help us to improve

330
00:37:40,260 --> 00:37:42,660
this tool, help us to make it perfect.

331
00:37:47,340 --> 00:37:55,100
Um, you, if you go to the uh, Patreon website, you have all to the Kismet Wireless web, uh,

332
00:37:55,300 --> 00:38:03,620
website, you will see the link, how to become a patron. So any support, uh, towards project

333
00:38:03,620 --> 00:38:14,060
would be greatly appreciated. Um, this is my particulars, my data, you can always email,

334
00:38:14,220 --> 00:38:24,040
me, call me. Uh, I'm in the eastern standard time, so make an adjustment, please. Um, that's

335
00:38:24,040 --> 00:38:33,840
about it. So if anybody has any questions... So demo is over there. So whoever wants to see the

336
00:38:33,840 --> 00:38:37,820
demo, it's near the wall, on the back. Thanks.

337
00:38:39,100 --> 00:38:39,620
.